Export events from a log, log file, or using structured query to a file. Usage: wevtutil { epl | export-log } /OPTION:VALUE ...

Export events from a log, log file, or using structured query to a file.

Usage:

wevtutil { epl | export-log }  
  [/OPTION:VALUE [/OPTION:VALUE] ...]


By default, you provide a log name for . However, if you
use the /lf option, then you provide the path to a log file for the 
value. If you use the /sq parameter, then you provide the path to a file
containing a structured query. 


Path to the file where the exported events are to be stored.

Options:

You can use either the short (for example, /l) or long (for example, /locale) 
version of the option names. Options and their values are not case-sensitive.

/{lf | logfile}:[true|false]
If true,  is the path to a log file.

/{sq | structuredquery}:[true|false]
If true,  is the path to a file that contains a structured query. The 
command might take a long time if selecting many, but not all, events.

/{q | query}:VALUE
VALUE is an XPath query to filter the events you want to export. If not 
specified, all events will be returned. This option is not available when /sq is 
true. The command might take a long time if selecting many, but not all, events.

/{ow | overwrite}:[true|false]
If true, and the destination file specified in  already exists, it 
will be overwritten without confirmation.

Example:

The following example exports events from System log to 
C:\backup\system0506.evtx.

wevtutil epl System C:\backup\system0506.evtx